(upbeat music)
- Hi there.
My name is Mohamad, Cloud Support Associate
here at the AWS office in Sydney.
Customers often ask me,
how to create, an IAM policy,
that will restrict control of EC2 instances using tags.
For example,
a customer wants to grant his Developers,
the ability to start, stop,
and reboot specific EC2 instances,
that have a specific tag,
or grant, an IAM user control to an EC2 instance,
that is tagged with their friendly name.
So let me walk you through this process.
After logging into the AWS Management Console,
navigate to the EC2 Console.
Then click on Instances.
Then add tags to the EC2 Instances,
that you want certain users or group,
to be able to control.
I'm logged in as the Administrator.
As the Administrator,
I'm responsible for tagging EC2 instances.
I have two Instances here.
Instance 1 and Instance 2.
I want my IAM users and the Developers group
to be able to start, stop and reboot Instance 1,
and so I'll grant my IAM user Neo,
the ability to only start, stop,
and reboot instance number two.
To add the tags, choose Instance 1.
Then on the tags tab,
add a new key value pair by choosing Add, Edit tags.
I'll add the key Team,
and the value is equal to Developers,
and then Save.
While on Instance 2,
I'll add a new key value pair,
with the key as Owner and the value equal to Neo.
Just remember,
that values for EC2 tags are case sensitive,
while the keys are not case sensitive.
Now let's head over to the IAM console,
to Create, and Attach the policies.
Then click on Users.
In my IAM Console, I have two users here,
Trinity who belongs to the Developers group, and Neo.
Let's add a new policy for the Developers crew,
on the left navigation pane,
click on Policies,
then click on Create Policy.
First we need to grant Developers access
to the EC2 Console,
by allowing them that describe actions,
for all resources in a separate policy statement,
because the describe API actions,
do not support resource level permissions.
Click on the JSON tab.
I'm going to paste my policy statement.
Then we'll create another statement
to start, stop, reboot,
all instances that have the condition
that they are tagged with the key team
and the value equal to Developers,
using the EC2 service conditioned resource tag.
Now additionally,
we'll add another policy statement
to explicitly deny access to the EC2 Create tags,
and EC2 Delete tags actions,
to prevent users from creating or deleting tags
on the EC2 instances.
Now let's review the Policy,
and give it appropriate name and descriptions.
Click on Review.
Now that I have the name and description filled out,
let's go ahead and Create the policy.
As we just created the policy,
you can simply click on the policy,
by clicking on the link just right here,
or you can filter through the policy,
to find the policy that you want.
Now go ahead and attach the policies
to the Developer's group.
Click on the Policy,
and on the policy actions.
Click on Attach.
Choose the Developers group,
and then click Attach policy.
So now we're going to create a policy for Neo.
Click on Create policy.
Similarly for Neo,
we're going to use the same policy,
that we use for the developers group,
but modify the resource tag EC2 service condition,
to have the key equal to honor,
and the value equal to the username variable.
Click on JSON,
and then we're going to paste the same policy
for the Developers group.
So I'm going to modify, the team key here
to the value Owner,
and the Developers to the IAM variable username.
They username value here, is a policy variable
that's IAM replaces with the friendly name
of the current user, when the policy is evaluated.
This, review this policy
and also give it an appropriate name and description.
Click on Review,
and give the appropriate name and description
to your policy.
Once you have these filled out,
go ahead and Create the policy.
Now let's go ahead and attach this policy to Neo.
Click on the policy name,
and on Policy actions,
Click on Attach.
Click on Neo, and then Attach policy.
Now let's sign in as Neo.
Now that I'm signed in as Neo,
I'll navigate to the EC2 console,
then click on Instances.
If I tried Stop instance one as Neo,
this action fails,
as I don't have the permissions to do it,
because am only able to start, stop
or reboot EC2 instances,
that are tagged with my username as the owner.
I'm gonna click on Instance 1,
and on actions, on the Instance State,
click on Stop.
However, if I try to Stop or reboot Instance 2,
I can do that successfully,
because Instance 2,
is tagged with the key Owner, and the value Neo.
Now if I'm signed in as Trinity,
who is part of the developer's group,
then I can successfully stop Instance 1.
If I click on Instance 1,
and then click on Actions,
Instance state, then Stop.
I should be able to successfully stop it.
Here we go.
However, if I tried to Start Instance 2,
the permission is denied,
and I'm not authorized,
because the instance is not tagged,
with the key value pair, Team and Developers.
Additionally, if I try to Add,
a new value pair, Team, Developers to Instance 2
so that I can stop it, my attempt will fail,
because I don't have the permissions to create tags.
Therefore users and the developers group,
can only start, stop, reboot instances,
that are tagged with the key value pair,
Team and Developers.
While Neo can only start, stop or reboot instances,
that have been tagged with his username as the Owner.
By using the EC2 to service-specific condition Resource Tag,
you can grant granular permissions,
to your IAM users to control
EC2 instances based on the tags
associated with EC2 instances.
Thanks for watching,
and happy cloud computing from all of us here at AWS.
(upbeat music)